CVE-2023-0098
Last modified
CVE-2023-0098 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.. EPSS estimates a 0.94% chance of exploitation in the next 30 days.
Description
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Getlasso | Simple Urls | < 115 |
References
- https://wpscan.com/vulnerability/db0b3275-40df-404e-aa8d-53558f0122d8Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/db0b3275-40df-404e-aa8d-53558f0122d8Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-0098?
How severe is CVE-2023-0098?
How do I fix CVE-2023-0098?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-0092An authenticated user who has read access to the juju contro…4.9
- CVE-2023-0093Okta Advanced Server Access Client versions 1.13.1 through 1…8.8
- CVE-2023-0094The UpQode Google Maps WordPress plugin through 1.0.5 does n…5.4
- CVE-2023-0095The Page View Count WordPress plugin before 2.6.1 does not v…5.4
- CVE-2023-0096The Happyforms WordPress plugin before 1.22.0 does not valid…5.4
- CVE-2023-0097The Post Grid, Post Carousel, & List Category Posts WordPres…5.4
- CVE-2023-0099The Simple URLs WordPress plugin before 115 does not sanitis…6.1
- CVE-2023-0100In Eclipse BIRT, starting from version 2.6.2, the default co…8.8
- CVE-2023-0101A privilege escalation vulnerability was identified in Nessu…8.8
- CVE-2023-0102LS ELECTRIC XBC-DN32U with operating system version 01.80 is…9.1
- CVE-2023-0103If an attacker were to access memory locations of LS ELECTRI…7.5
- CVE-2023-0104 The listed versions for Weintek EasyBuilder Pro are vulnera…7.8
Are you affected by CVE-2023-0098?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST